Identification and authentication

What is identification and authentication in simple words

Identification and authentication are two interrelated processes that form the basis of access control to information and physical resources. In simple words, identification is when you introduce yourself to the system, and authentication is when you prove that you are exactly who you claim to be.

Imagine that you come to a bank. First, you tell the cashier your name (this is identification). Then you present your passport to prove that you are really the owner of this name (this is authentication). In the digital world, everything happens the same way: you enter a login (identification) and a password (authentication).

These processes are the first line of defense of any information system. Without identification, the system does not know who is addressing it. Without authentication, it cannot be sure that the person addressing it is really who they claim to be. Only after successfully passing both stages does the system authorize the user — it determines which resources and actions are available to them.

It is important to understand that identification and authentication are not the same thing, and they cannot be confused. Identification answers the question "Who are you?", and authentication answers the question "Are you really you?". Together they ensure secure access to systems and data.

Authentication methods

There are three classic authentication factors, and they are divided by the type of information being checked:

• Knowledge (something you know): Password, PIN code, answer to a secret question. This is the most common but also the least secure method, since a password can be spied on, guessed or stolen.
• Possession (something you have): A phone for receiving an SMS code, a hardware token, a bank card, a key fob. This method is more secure, since an attacker needs to physically take possession of your device.
• Attribute (something you are): Biometric characteristics — fingerprint, face, voice, iris. This is the most secure method, since biometrics cannot be forgotten, lost or transferred to another person.

Single-factor authentication uses only one of these methods (for example, only a password). Two-factor (2FA) — two different factors (for example, password + SMS code). Multi-factor (MFA) — three or more factors. The more factors used, the higher the security level.

Biometric authentication is becoming increasingly popular thanks to the development of technologies. It is implemented using the Biomark (fingerprints) and Biovizum (face recognition) products. Biometrics provides a high level of security and convenience, as it does not require remembering passwords or carrying additional devices.

In government systems, ESIA (Unified Identification and Authentication System) is used — this is the Gosuslugi portal, which is integrated with SMEV for interdepartmental interaction. Through ESIA, citizens gain access to hundreds of government services using a single login and password or biometrics.

Application

Identification and authentication are used in a wide variety of areas:

• Logging into operating systems and corporate networks: Every employee undergoes identification and authentication when logging into their work computer or corporate network.
• Access to web applications and services: Any website requiring registration uses identification (login) and authentication (password).
• Access control systems (ACS): At enterprises and secure facilities, employees are identified by passes or biometrics, and then authenticated for passage.
• Banking systems: When logging into an online bank or mobile application, the client undergoes identification and authentication, often using two-factor authentication.

Designing an authentication system includes choosing methods, protocols and protection tools. Design services help develop an optimal architecture taking into account security requirements, ease of use and integration with existing systems. Read more about approaches in the technologies section.